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1.  SCOPE. 

This  TOP  describes  a  systematic  approach  to  safety  and  performance  testing  of  Unmanned 
Ground  Vehicles  (UGVs).  The  objective  is  to  ensure  that  the  design  of  each  UGV  includes 
positive  measures  to  enhance  system  safety,  and  that  hazards  which  could  reduce  system  safety 
are  eliminated  or  controlled  to  an  acceptable  level  of  risk.  This  overarching  document  will  point 
to  other  TOPs  or  International  Test  Operations  Procedures  (ITOPS)  for  more  detailed 
explanation  of  specific  test  activities. 

1.1  Purpose. 

The  purpose  of  this  document  is  to  provide  a  systematic  approach  to  testing  UGVs  in  order  to 
ensure  that  the  overall  safety  of  the  system  is  adequate  and  that  the  perfonnance  of  the  UGV 
meets  with  expectations.  It  describes  activities  necessary  to  ensure  safety  is  designed  into  the 
system  under  test.  This  document  provides  unifonn  procedures  for  developing  and  implementing 
a  test  methodology  of  sufficient  comprehensiveness  to  identify  hazards  of  a  system  and  to  verify 
performance  of  the  system  meets  with  system  requirements. 

1.2  Applicability. 

This  document  is  appropriate  for  application  to  UGVs  regardless  of  size,  mode  of  operation,  or 
type  of  weapon  employed.  This  document  applies  to  tethered,  remote-controlled,  tele-operated, 
and  autonomous  controlled  ground  vehicles.  Robotic  systems  addressed  in  this  TOP  cover  the 
full  spectrum  from  throwable  systems  weighing  approximately  a  quarter  pound  up  to  70  ton 
vehicles  and  range  in  capabilities  from  pure  remote  control  or  tele-operated  systems  to  fully 
intelligent  and  autonomous  systems.  Any  capabilities  not  under  on-board  human  control  such  as 
weapons  firing  or  vehicle  movement  are  also  covered  by  this  document. 

1.3  Activities  Addressed. 

The  information  contained  herein  applies  to  any  testing  of  robotic  systems,  whether  simply 
obtaining  a  safety  release  or  conducting  a  formal  developmental  test  program  for  systems 
acquisition.  As  with  any  test  program,  tailoring  of  test  procedures  to  the  specific  needs  of  the 
system  and  its  intended  use  are  encouraged.  This  document  also  applies  to  the  experimentation 
and  demonstration  of  robotic  system  capabilities.  Although  many  sections  of  this  document  may 
not  apply,  all  safety  related  sections  still  apply,  as  the  safety  of  personnel  and  avoidance  of 
damage  to  vehicles,  equipment,  and  facilities  near  robotic  systems  must  be  assured. 

1.4  Limitations. 

a.  This  document  is  only  for  testing  of  UGVs.  Methodologies  for  testing  of  Unmanned 
Aerial  Vehicles  (UAVs)  or  Unmanned  Submersible  Vehicles  (US Vs)  are  not  covered  in  this 
document.  This  document  does  not  apply  to  automated  subsystems  that  do  not  directly  affect 
people  or  objects  outside  of  the  vehicle  such  as  automated  internal  weapon  loading  systems  or 
automated  tracking  subsystems,  nor  to  automated  driver-assist  functions  that  require  full-time 
on-board  driver  attention  to  perform  a  task  such  as  cruise  control,  anti-lock  brake  systems,  or 
self-leveling  systems. 
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b.  This  document  is  applicable  to  testing  of  multiple  UGVs  working  in  the  vicinity  of 
each  other;  however,  testing  of  multiple  UGVs  working  in  cooperation  is  not  addressed  in  this 
document. 

1.5  Introduction  to  UGVs. 

1.5.1  Need  and  Roles  for  UGVs. 

UGVs  are  robotic  platforms  that  are  used  as  an  extension  of  human  capability.  These  robots  are 
generally  capable  of  operating  outdoors  and  over  a  wide  variety  of  terrain,  functioning  in  place 
of  humans.  UGVs  are  generally  used  to  complete  tasks  that  are,  from  a  human  perspective,  dull, 
dirty,  or  dangerous.  Tasks  such  as  reconnaissance,  explosive  ordnance  disposal,  mine  clearing, 
and  logistic  resupply  are  typical  examples  of  jobs  suited  for  UGVs.  Due  to  the  wide  range  of 
tasks  that  can  be  accomplished  with  UGVs,  there  are  necessarily  a  wide  range  of  types  of  UGVs; 
however,  the  general  principles  for  testing  UGVs  can  be  applied  regardless  of  UGV  type. 

1.5.2  UGV  Categories. 

UGVs  can  be  generally  defined  based  on  three  categories:  size,  mode  of  operation,  and  weapon 
type. 


a.  Size 

(1)  MicroUGV:  An  unmanned  ground  vehicle  weighing  less  than  10  lbs. 

(2)  SUGV:  (Small  Unmanned  Ground  Vehicle):  An  unmanned  ground  vehicle 
weighing  less  than  200  lbs. 

(3)  MUGV  (Medium  Unmanned  Ground  Vehicle):  An  unmanned  ground  vehicle 
weighing  between  200  and  2,000  lbs. 

(4)  LUGV  (Large  Unmanned  Ground  Vehicle):  An  unmanned  ground  vehicle 
weighing  more  than  2,000  lbs. 

b.  Mode  of  operation 

(1)  Tethered:  A  mode  of  control  wherein  the  human  operator  controls  the  UGV 
through  a  direct,  wired  connection.  An  example  of  such  connection  would  be  a  fiber  optic  cable. 
Typically  a  line  of  sight  (LOS)  must  be  maintained  under  tethered  operation;  however,  under 
certain  circumstances,  a  LOS  isn’t  necessary  (i.e.,  operation  in  tunnel,  around  corners,  etc). 

(2)  Remote  Controlled:  A  mode  of  control  wherein  the  human  operator  must  dedicate 
100  percent  of  their  attention  to  system  operation  without  benefit  of  sensory  feedback  from  the 
vehicle.  A  LOS  must  be  maintained  with  the  vehicle  under  remote  control  operation. 

(3)  Teleoperated:  A  mode  of  control  wherein  the  human  operator  has  control  of  the 
UGV  through  cues  provided  by  video,  audio  and  digital  feedback.  The  human  operator  controls 
the  UGV  through  a  wireless  connection  transmitted  over  radio  frequencies  (RF).  The  human 
operator  must  dedicate  100  percent  of  their  time  to  operating  the  UGV.  A  LOS  does  not 
necessarily  need  to  be  maintained  under  tele-operation. 
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(4)  Autonomous:  A  mode  of  control  wherein  the  UGV  is  self-sufficient.  The  human 
operator  can  program  a  mission  for  the  UGV,  but  the  UGV  will  execute  the  mission  without  any 
human  interaction.  There  are  varying  levels  of  autonomy  in  regards  to  the  level  of  human 
interaction  with  the  UGV. 

(5)  Semi-autonomous:  A  UGV  that  has  multiple  modes  of  control  occurring 
simultaneously  to  include  at  least  one  autonomously  controlled  function.  The  level  of  semi¬ 
autonomy  can  vary  greatly  from  UGV  to  UGV  and  will  tend  to  be  used  extensively  on 
weaponized  UGVs  (i.e.  a  weaponized  UGV  equipped  with  an  Autonomous  Navigation  and 
Obstacle  Avoidance  System,  but  with  tele-operated,  operator  controlled  weapon  functions). 

(6)  Manned:  A  mode  of  control  wherein  the  UGV  is  directly  controlled  by  a  human 
operator  through  the  use  of  a  steering  wheel,  etc. 

c.  Weapon  type 

(1)  Weaponized,  projectile:  A  UGV  equipped  with  any  device  that  launches  a 
projectile  (i.e.,  machine  gun,  smoke  grenades,  lane  markers). 

(2)  Weaponized,  non-projectile:  A  UGV  equipped  with  any  energetic  device  that  can 
affect  the  area  around  the  vehicle  without  launching  a  projectile  (i.e.,  acoustic,  laser,  sonic 
devices) 

(3)  Weaponized,  non-lethal  projectile.  A  UGV  equipped  with  a  weapon  or  device 
that  launches  a  non-lethal  projectile  (i.e.,  rubber  bullets,  pepper  balls,  netting,  paint  balls,  etc.) 

(4)  Non-weaponized:  A  UGV  not  equipped  with  a  weapon  or  device  that  affects  the 
environment  around  the  vehicle. 

2.  FACILITIES  AND  INSTRUMENTATION. 

2.1  Test  Facilities  and  Conditions. 

a.  Existing  test  facility  types  should  be  used  when  possible.  It  is  necessary  to  consider 
all  types  of  climatic  and  environmental  conditions  in  a  great  variety  of  soil  types.  The  tester 
should  consider  the  effects  of  operating  on  primary  roads,  secondary  roads,  cross-country  terrain, 
and  the  ability  to  operate  in  and  around  natural  and  man-made  obstacles.  The  tester  should  also 
consider  the  effects  of  high  and  low  temperature  extremes,  humidity,  snow,  freezing  rain,  sand, 
dust,  vibration,  and  electromagnetic  interference.  Instrumentation  and  system  operational 
equipment  procedures  for  each  facility  should  be  created  and  may  vary  based  on  the  type  of 
equipment  being  tested. 

b.  Courses  that  are  being  used  for  UGV  testing  must  be  accurately  digitally  modeled  in 
order  to  be  used  to  verily  the  UGV  cognitive  abilities  when  applicable.  This  digital  model  will 
be  used  as  the  “control”  that  can  be  compared  to  the  UGV’s  perception  in  order  to  determine  if 
there  are  variances  between  the  UGV’s  perception  and  what  actually  exists.  These  facilities 
must  be  accurately  instrumented  and  calibrated  to  include  RF  and  meteorological  monitoring 
stations  in  order  to  accurately  depict  changing  conditions  of  the  course. 
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c.  Dedicated  UGV  test  courses  should  be  equipped  with  complete  video  coverage  of  the 
entire  course  in  order  to  record  mishaps  and  incidents  while  also  providing  situational  awareness 
to  personnel  monitoring  the  test  from  a  safe  location. 

d.  UGVs  should  be  tested  in  facilities  where  there  are  no  other  experimental  systems 
under  test. 

2.2  Instrumentation. 

a.  A  wide  range  of  instrumentation  must  be  available  to  measure  the  performance  of  the 
components,  subsystems,  sensors,  algorithmic  processes,  and  telemetric  links,  and  to  capture 
required  data.  This  data  will  be  used  not  only  to  verify  the  performance  and  safety  of  the 
vehicle,  but  also  to  validate  system  models  which  can  then  be  used  to  create  larger  data  sets  to 
complement  physical  testing.  Therefore,  when  designing  the  instrumentation  package  for  the 
system  under  test,  data  required  to  validate  system  models  must  considered. 

b.  In  general,  instrumentation  will  continue  to  be  used  in  traditional  physical  test  roles  to 
gather  pertinent  component  level  data  using  accelerometers,  thermocouples  and  the  like. 

c.  Additional  instrumentation  requirements  must  be  considered  when  testing  UGVs. 
UGVs  will  rely  extensively  on  sensors  to  provide  information  regarding  the  environment  in 
which  the  UGV  is  operating.  Data  instrumentation  packages  must  be  able  to  pull  information 
from  the  sensors  prior  to  manipulation  of  that  information  by  the  UGV  algorithmic  processes  as 
well  as  processed  infonnation  such  as  the  perception  map,  decisions  about  the  map,  and  planned 
actions. 

d.  In  order  to  understand  how  the  UGV  uses  the  sensor  information  it  receives  to  make 
decisions,  data  log  files  of  the  UGVs  algorithmic  process  will  be  recorded.  This  information  can 
be  used  to  understand  why  and  how  the  UGV  made  its  decisions.  This  information  also  will  be 
used  to  validate  system  models  and  will  allow  for  test  repeatability  that  would  not  normally  be 
available  without  this  information. 

e.  Following  execution  of  the  UGVs  algorithmic  processes,  there  will  be  outputs  to  the 
vehicle  subsystems  generally  based  on  the  UGVs  “worldmap”  or  perception  of  its  environment. 
Data  instrumentation  packages  must  be  used  to  capture  this  perception  and  outputs  to  the  system 
in  order  to  detennine  the  accuracy  of  the  UGVs  perception  and  the  correctness  of  its  response. 

f.  Generally,  UGVs  will  export  their  view  of  the  world  to  an  external  controller  or 
System  of  Systems.  Testers  must  have  access  to  the  same  vehicle-created  worldmaps  that  are 
being  used  by  system  developers.  Data  instrumentation  packages  should  be  used  to  capture 
information  as  it’s  sent  from  the  UGV,  and  as  it’s  received  by  the  external  controller,  in  order  to 
determine  if  there  is  degradation  in  information  quality  caused  by  or  occurring  during  the 
information  transfer. 

g.  A  redundant  emergency  stop  (E-stop)  with  an  independent  power  supply  will  be 
installed  on  each  UGV. 
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h.  A  strobe  light,  which  will  activate  when  the  UGV  engages  in  remote  or  autonomous 
operations,  will  be  installed. 

i.  The  use  of  three  dimensional  (3D)  viewers  and  system  models  may  be  needed  to 
monitor  vehicle  states  and  projected  path  or  weapon  footprints  for  safety  purposes. 

j.  Real  Time  and  Near  Real  Time  Analysis  Displays.  Testers  need  access  to  information 
to  ensure  the  safety  of  ah  test  personnel,  to  protect  the  test  article  as  much  as  possible,  and  to 
ensure  that  the  test  unfolds  as  planned.  Examples  may  include  temperature  profiles  of  critical 
components,  comparisons  of  true  and  perceived  world  maps,  vehicle  planned  paths,  the  states  of 
weapons  and  payloads,  actual  and  predicted  data  link  quality,  and  other  information  as 
determined  by  the  test  director. 

k.  For  Micro  UGVs,  SUGVs,  and  small  MUGVs,  the  data  acquisition/instrumentation 
package  must  be  small  enough  so  as  to  not  affect  the  performance  of  the  UGV  under  test. 

2.3  Modeling  and  Simulation. 

a.  Data  Link  Prediction.  Testers  may  use  RF  propagation  prediction  tools  for  some 
systems  to  predict  the  areas  where  the  data  link  may  be  marginal  or  unacceptable  for  the  test 
article  and  E-Stop  systems.  This  information  helps  the  tester  maintain  positive  control  of  the 
UGV  at  ah  times  and  to  ensure  that  a  valid  test  is  conducted. 

b.  3D  Models.  As  a  part  of  test  planning,  testers  may  use  3D  models  of  the  vehicle  and 
the  test  area  to  ensure  that  the  vehicle  is  properly  presented  with  challenges.  Avenues  of 
approach  may  be  adjusted  accordingly  during  the  test  planning  process  to  achieve  test  objectives. 
These  models  may  also  be  used  during  test  execution  to  support  monitoring  UGV  perfonnance. 
This  is  especially  important  in  areas  of  difficult  terrain  or  where  obscurants  are  present. 

3.  REQUIRED  TEST  CONDITIONS. 

3.1  Test  Item  Configuration. 

a.  The  item  should  be  tested  at  system,  subsystem,  and  component  levels.  Each  discreet, 
identifiable  component  or  subsystem  should  be  tested  and  measured  for  overall  contribution  to 
the  system.  Sufficient  testing  should  be  conducted  to  demonstrate  that  the  operator,  software, 
vehicle  platform,  control  unit,  and  mechanical  operating  devices  and  applications  can  work 
effectively  together.  Knowledge  of  software  versions  is  critical  to  successful  conduct  of 
developmental  testing.  The  test  instrumentation  suite  should  be  selected  based  on  the  objective  of 
the  test  and  the  data  required.  Individual  components  should  be  instrumented  when  required. 

b.  For  a  UGV,  the  main  components  addressed  for  system  level  testing  are  referred  to  in 
this  document  as  the  human  operator,  vehicle  platform,  software,  operator  control  unit  (OCU), 
Mobile  Base  Unit  (MBU)  or  vehicle  control  unit  (VCU),  RF  links,  video  links,  tethered  links, 
mechanical  operating  devices,  and  the  application  hardware. 
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(1)  The  human  operator  controls  the  platform  either  remotely  with  an  RF  or  tethered 
link  or  programs  commands  for  autonomous  operation. 

(2)  Software  is  used  as  artificial  intelligence  to  control  functions  and  coordinate  the 
activities  of  other  components. 

(3)  The  vehicle  platform  provides  mobility. 

(4)  The  OCU  is  the  remote  work  station  for  the  human  operator  that  enables  remote 
control  of  selected  driving  and  associated  functions. 

(5)  The  MBU  or  VCU  interface  between  the  OCU  and  the  mechanical  operating 
devices  on  the  UGV.  RF,  video  and  tethered  links  establish  communication  between  the  UGV 
and  the  command  vehicle. 

(6)  The  application  hardware  is  the  means  to  perform  the  specified  task  of  the  UGV. 
3.2  Test  Planning. 

a.  Test  planning  should  be  initiated  early  in  the  acquisition  process  in  order  to  yield  the 
most  cost  effective  approach  to  decision  risk  mitigation.  Component  and  subsystem  level  testing 
should  be  conducted  throughout  the  development  of  the  system.  Each  version  must  demonstrate 
effective  support/operation  of  the  system.  The  level  of  testing  should  be  carefully  considered. 
System  level  testing  should  be  conducted  whenever  an  operational  system  is  available. 
Performance  of  the  individual  components  should  be  determined  during  system  level  testing  to 
confirm  design  goals.  All  subsystems  and  components  should  be  individually  qualified  prior  to 
integration  into  the  system.  Software  is  a  critical  component  that  must  be  rigorously  tested. 

b.  Testing  should  be  conducted  to  demonstrate  that  the  logistics  concept  is  adequate. 
Issues  in  the  areas  of  maintenance,  transportation,  and  storage  must  be  addressed  along  with 
availability,  accuracy,  and  comprehensibility.  A  logistics  demonstration  should  be  conducted 
with  the  system  and  representative  soldiers  who  will  perform  maintenance  on  the  system. 
Transportability  testing  is  required  to  support  the  Military  Traffic  Management  Center 
Transportability  certificate. 

c.  Test  planning  should  address  the  following: 

(1)  Purpose  of  testing. 

(2)  Test  objectives. 

(3)  Test  criteria. 

(4)  Test  method. 

(5)  Data  required. 
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(6)  Data  analysis  techniques. 

d.  Criteria  for  each  subtest  data  topic  will  be  defined  based  on  applicable  contractual 
specifications  and  military  requirements  documents.  Where  the  criteria  are  not  clearly  specified, 
criteria  will  be  developed  from  the  relevant  ITOP,  TOP,  MIL-STD,  federal  statute,  or  other 
controlling  document.  Development  of  criteria  should  consider  the  logistics  concept, 
employment  concept,  intended  application,  novel  technologies,  and  threat  environment  as 
appropriate.  Failures  and  successes  should  be  defined  to  provide  for  a  clear  understanding  of 
relevant  conclusions  for  certain  subtest  data  topics  (i.e.,  reliability,  performance,  climatic 
suitability,  electromagnetic  interference,  and  safety). 

e.  Data  requirements  and  analytical  techniques  necessary  to  address  objectives  and 
criteria  will  be  established.  It  should  be  established  which  data  requirements  will  be  satisfied 
through  physical  test,  and  data  sheets  for  each  sub  test  data  topic  should  be  designed. 

f.  Appropriate  test  procedures  for  each  subtest  topic  relative  to  objectives,  criteria,  and 
data  requirements  should  be  selected. 

g.  As  a  tool  to  audit,  change,  or  summarize  the  test  program,  it  is  desirable  to  layout  all 
events  and  data  requirements  in  matrix  format.  As  applicable,  the  test  matrix  should  have  a  cell 
for  each  test  objective,  criteria,  component,  subsystem,  system  test  event,  item  configuration, 
data  requirement,  and  analytical  technique.  Multiple  matrices,  each  of  which  is  linked,  may  be 
required.  Identify  any  unique  resources  necessary  to  conduct  subtests. 

h.  How  modeling  and  simulation  will  be  used  to  answer  test  objectives  should  be 
identified  within  the  detailed  test  plan. 

3.3  Frequency  Allocation. 

a.  The  UGV  Test  Director  is  responsible  for  requesting  frequency  assignments  from  the 
local  frequency  manager  in  the  proposed  area  of  deployment.  The  local  frequency  manager 
receiving  the  frequency  assignment  application  will  process  it  through  established  channels  to 
request  appropriate  national  and/or  international  approval.  The  disposition  of  the  frequency 
assignment  request  will  be  channeled  back  to  the  user.  The  request  may  be  approved, 
disapproved  in  total,  or  approved  in  part  with  operating  limitations.  The  information  presented 
in  Appendix  A  of  this  document  must  be  provided  by  the  test  proponent  in  order  to  submit  the 
appropriate  frequency  allocation  request  fonn. 

b.  This  information  must  be  provided  by  the  test  proponent  no  less  than  120  days  prior  to 
the  start  of  testing  in  order  to  ensure  approvals  are  obtained  within  the  desired  schedule.  This 
information  must  be  provided  for  each  transmitter  and  receiver. 
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3.4  Supporting  Documents. 

a.  In  order  to  properly  assess  the  safety,  perfonnance  and  reliability  of  a  UGV,  a  detailed 
documentation  review  must  be  conducted.  This  documentation  review  provides  a  more  thorough 
understanding  of  UGV  characteristics  and  in  some  instances  can  reduce  the  amount  of  physical 
testing  required  and  can  assist  in  reducing  the  assigned  risk  assessment  code  reported  in  safety 
releases.  The  documentation  review  is  required  in  order  to  ensure  that  proper  safety  protocols 
are  emplaced  prior  to  initiation  of  testing.  The  following  documents  should  be  included  in  the 
test  item  data  package;  it  is  preferable  that  these  documents  be  provided  as  early  as  possible  prior 
to  the  start  of  testing.  A  documentation  review  checklist  is  presented  in  Appendix  B. 

(1)  Safety  Assessment  Report  (SAR)  -  Required  Document  -  The  SAR  is  a  formal, 
comprehensive  safety  report  that  summarizes  the  safety  data  that  has  been  collected  and 
evaluated  during  the  life  cycle  of  an  item.  It  expresses  the  considered  judgment  of  the  contractor 
or  developing  agency  regarding  the  hazard  potential  of  the  item  and  any  actions  or  precautions 
that  are  recommended  to  minimize  these  hazards  and  to  reduce  the  exposure  of  personnel  and 
equipment  to  them.  In  addition,  US  Army  Center  for  Health  Promotion  and  Preventive  Medicine 
(CHPPM)  certifications  must  be  provided  for  lasers,  and  Material  Safety  Data  Sheets  (MSDS) 
must  be  provided  for  batteries,  fuels,  etc. 

(2)  Preliminary  Hazard  Assessment  (PHA)  -  Required  Document  -  Broad  hazard¬ 
screening  tool  that  includes  a  review  of  the  work  that  will  be  performed  in  a  facility  and 
identifies  the  hazards  associated  with  the  work  and  the  facility.  The  results  of  the  PHA  are  used 
to  determine  the  need  for  additional,  more  detailed  hazard  analysis,  serve  as  a  precursor 
documenting  that  further  analysis  is  deemed  necessary,  and  serve  as  a  baseline  hazard  analysis 
where  further  analysis  is  not  indicated. 

(3)  Software  Requirements  Specification  (SRS)  -  Required  Document  -  Complete 
description  of  the  behavior  of  the  system  to  be  developed.  It  includes  a  set  of  use  cases  that 
describe  all  of  the  interactions  that  the  users  will  have  with  the  software.  Use  cases  are  also 
known  as  functional  requirements.  In  addition  to  use  cases,  the  SRS  also  contains  nonfunctional 
(or  supplementary)  requirements.  Non-functional  requirements  are  requirements  which  impose 
constraints  on  the  design  or  implementation  (such  as  perfonnance  requirements,  quality 
standards,  or  design  constraints). 

(4)  Capabilities  Requirements  Document  (CRD)  /Operational  Requirements 
Document  (ORD)  -  Required  Document  -  Describes  the  overall  mission  area,  the  type  of  system 
proposed  and  the  anticipated  operational  and  support  concepts  in  sufficient  detail  for  program 
and  logistics  support  planning  and  includes  a  brief  summary  of  the  mission  need.  If  the  mission 
need  was  not  documented  prior  to  preparation  of  the  CRD/ORD,  the  process  that  investigated 
alternatives  for  satisfying  the  mission  need  and  developing  the  operational  requirements  is 
explained. 
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(5)  Performance  Specification/System  Specification/Purchase  Description  -  Required 
Document  -  Communicates  the  user’s  requirements  to  the  manufacturer.  These  documents 
translate  operational  requirements  into  more  technical  language  that  tells  the  manufacturer:  1) 
what  will  be  considered  an  acceptable  product,  and  2)  how  it  will  be  determined  if  the  product  is 
acceptable. 

(6)  Security  Classification  Guide  -  Required  Document  -  A  documentary  fonn  of 
classification  guidance  issued  by  an  original  classification  authority  that  identifies  the  elements 
of  information  regarding  a  specific  subject  that  must  be  classified  and  establishes  the  level  and 
duration  of  classification  for  each  such  element. 

b.  Programmatic  documents  that  were  developed  for  the  system,  or  those  preexisting 
documents  that  apply,  should  be  used  to  identify  test  criteria.  These  documents  define  the 
mission  scenarios,  climatic  conditions,  operational,  and  electromagnetic  environments  in  which 
the  item  must  operate.  Documents  that  should  be  used  to  establish  test  criteria  include: 

(1)  Operational  Mode  Summary /Mission  Profile. 

(2)  Operational  Requirements  Document/Capabilities  Requirements  Document. 

(3)  Purchase  Description/Performance  Specification/System  Specification. 

(4)  Military  Regulations,  Standards  and  other  controlling  directives. 

(5)  Federal  Statutes. 

(6)  Test  Directives. 

c.  The  following  documents  are  desired  if  they  are  available: 

(1)  Developer  Software  Functional  Qualification  Test  Plans  and  Reports. 

(2)  Component  Level  Test  Plans  and  Reports. 

(3)  System  Operator  Manuals. 

(4)  System  Maintenance  and  Repair  Manuals. 

(5)  Software  Trouble/Problem  Reports. 

(6)  System  Safety  -  Critical  Software  Requirements. 

(7)  Software  Traceability  Analysis. 

(8)  Data  Tap  Locations  and  Interface  Definitions. 
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(9)  Software  Design/Development  Documents. 

(10)  Message  Protocols/Definitions. 

(11)  Programmatic  Environmental,  Safety,  and  Health  Evaluation. 

(12)  Configuration  Management  Plan. 

(13)  Interface  Control  Document. 

(14)  Operational  Mode  Summary/Mission  Profile. 

3.5  Test  Controls. 

Test  controls  are  listed  for  each  subtest  data  topic  in  accordance  with  the  applicable  ITOP,  TOP 
or  military  standard  (MIL-STD). 

3.6  Safety. 

a.  Historically,  UGVs  have  a  high  incidence  of  uncontrolled  movement  caused  by 
various  means  including  RF  interference,  mechanical  failures,  software  design  issues,  etc.  Given 
this  historical  precedent,  additional  precautions  must  be  taken  with  regard  to  tester  safety  that 
would  not  normally  be  required  for  a  manned  vehicle  test.  The  safety  of  individual  components 
and  subsystems  must  be  demonstrated  prior  to  conducting  a  system  level  test.  All  components 
must  be  safe  or  the  hazards  controlled  to  an  acceptable  level. 

b.  Additionally,  a  complete  safety  and  health  hazard  analysis  should  be  made  throughout 
the  course  of  the  test.  During  the  initial  inspections  and  maintenance,  observations  should  be 
made  through  visual  examination  and  functional  checks  for  compliance  in  design  to  assure 
personnel  safety.  During  the  course  of  testing,  any  potential  hazard  observed  during  operations 
or  maintenance  actions  must  be  recorded.  All  scheduled  subtests  should  be  considered  in  the 
overall  safety  and  health  assessment. 

c.  A  complete  and  detailed  analysis  of  system  software,  software  development 
documents,  and  software  test  results  must  be  conducted  prior  to  the  start  of  actual  physical 
testing. 


(1)  Early  involvement  by  testers  in  system  software  development  is  required  in  order 
to  validate  the  capabilities,  robustness,  and  safety  features  of  the  software.  A  thorough 
understanding  of  the  contractor’s  software  development  process,  hazard  analysis,  software  test 
results,  and  software  trouble  reports  will  lead  to  an  accurate  assessment  of  the  residual  risk 
inherent  in  the  system’s  software  controls  and  processes. 

(2)  Clear,  accurate  documentation  of  software  version  updates/revisions  and  of 
regression  testing  of  software  version  updates/revisions  is  required  during  all  phases  of  testing. 
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d.  Specific  tests  to  determine  the  mechanical,  software,  and  operating  safety  of  the  entire 
system  can  be  completed  only  after  all  component  subsystem  testing  has  been  completed  or 
adequate  provisions  have  been  taken  to  prevent  any  accidental  injury  or  damage. 

e.  The  concept  of  a  UGV  locates  the  operator  away  from  the  platform;  therefore,  control 
must  be  maintained  when  the  telemetric  link  between  the  remote  operator  and  the  vehicle  is  lost, 
an  unanticipated  event  occurs,  or  an  unsafe  condition  exists.  As  a  minimum,  the  system  must 
demonstrate  the  ability  to  safely  stop  when  any  uncontrolled  event  or  unsafe  condition  occurs. 

All  emergency  and  fail-safe  systems  must  be  tested,  and  their  reliability  must  be  determined. 

f.  In  situations  during  testing  when  safety  related  decisions  must  be  made,  the  well  being 
of  personnel,  buildings,  and  vehicles  should  be  placed  above  that  of  the  test  item. 

g.  The  number  of  personnel  in  the  test  area  shall  be  limited  to  those  test  critical  personnel 
necessary  to  accomplish  the  test  mission  safely  and  efficiently.  Observers  and  spectators  shall 
remain  outside  of  the  hazardous  operating  zone  of  the  system  at  all  times  until  the  system  is 
rendered  safe  and  verified  to  be  safe  to  approach. 

h.  Prior  to  shipping  the  test  item,  or  transporting  it  between  local  test  sites,  a  safety 
assessment  must  be  performed.  Specific  items  to  be  considered  include  loading  and  unloading 
procedures  and  transportability  characteristics  of  the  test  item.  UGVs  will  not  be  permitted 
access  to  test  agency  roadways,  and  therefore  a  plan  must  be  in  place  to  transition  the  test  item 
from  test  site  to  test  site. 

i.  Until  the  safety  envelope  has  been  determined  by  operating  the  item  near  the 
maximum  safe  limit,  a  thorough  understanding  of  what  the  operator/maintainer  has  to  do  with, 
on,  in,  and  around  an  item  is  unknown  and  critical  hazards  could  exist.  This  is  especially  true  of 
software  controlled  systems,  where  unpredictable  and  unsafe  responses  may  result  from 
computer  failure,  maintenance  interlocks,  power  failures,  and  power-up  tests  (DA  PAM  73-1 1  , 
paragraph  6-63). 

j .  The  tester  should  identify  the  software  components  that  control  safety-related 
functions  and  give  them  special  attention.  Software  safety  activities  should  be  initiated  on  that 
component  and  continued  through  the  requirements,  design,  code  analyses,  and  testing  phases. 
The  tester  also  might  identify  the  need  for  a  more  formal  evaluation  of  software  safety,  based  on 
the  probability  that  the  software  might  cause  or  fail  to  prevent  failures  in  a  safety-critical  system 
component  (DA  PAM  73-1,  paragraph  Q-26.b). 

k.  Although  remote  operators  may  be  highly  trained  before  using  a  system,  training  is  not 
a  sufficient  preventive  measure  or  work-around  in  most  cases  for  safety  related  issues.  Products 
of  safety  related  testing  include  documentation  of:  conditions  in  which  the  system  can  and  cannot 
be  safely  operated;  and  the  propensity  for  the  total  system  to  enter  unsafe  operating  conditions. 


Superscript  numbers  correspond  to  those  in  Appendix  C,  References 
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l.  A  Safety  Release  indicates  a  system  is  safe  for  use  and  maintenance  and  describes  the 
specific  hazards  of  the  system,  operational  limits,  and  required  precautions  (DA  PAM  73-1, 
paragraph  6-64 .b).  The  Safety  Release  will  have  a  specific  start  and  end  date,  and  is  only  valid 
for  a  specific  time  period  or  event.  A  Safety  Confirmation  indicates  if  specific  safety 
requirements  are  met,  includes  a  risk  assessment  for  hazards  not  adequately  controlled,  lists 
technical  or  operational  limitations  or  precautions,  and  highlights  safety  problems  that  require 
further  investigation  (DA  PAM  73-1,  paragraph  6-65).  The  Safety  Confirmation  indicates  the 
system  is  ready  for  fielding,  has  a  specific  start  date,  and  is  valid  indefinitely.  The  scope  of 
testing  to  obtain  a  safety  release  and  confirmation  is  dependent  on  a  number  of  factors  to  include: 

(1)  Objectives  of  the  test,  demonstration,  or  experiment. 

(2)  Intended  use  of  the  robotic  system. 

(3)  Types  of  payloads,  attachments,  or  weapons  associated  with  the  system. 

(4)  Modes  of  control. 

(5)  Relative  positions  of  people  with  respect  to  the  system  (spectators,  casualties, 
remote  operators,  warfighters  on  the  ground,  manned  vehicles,  etc.). 

(6)  Functionality  and  reliability  of  the  render  safe  system 

(7)  Contractor  software  development  processes 

(8)  Analysis  of  contractor  software  test  results  and  software  trouble  reports 

m.  Ensure  that  the  necessary  Risk  Assessment  is  accomplished  relative  to  the  safety  of  the 
system  prior  to  testing.  This  should  include  the  following: 

(1)  All  platform  and  application  hardware  will  be  investigated  for  safety  prior  to 
operating  the  vehicle  in  an  unmanned  mode. 

(2)  Prior  to  test  initiation,  a  SAR,  which  includes  a  health  hazard  assessment  of  the 
UGV,  must  be  submitted  by  the  developer.  Particular  emphasis  should  be  placed  on  radio 
frequency  interference/hazards  as  well  as  the  safety  implication  of  embedded  software  controls. 

(3)  A  detailed  Failure  Modes  and  Effects  Analysis  (FMEA)  must  be  performed  to 
evaluate  the  safety  implications  of  the  failure  of  the  hardware  and/or  software.  All  hazards 
identified  will  be  evaluated  and  categorized  according  to  hazard  severity  and  probability. 
Resolution  of  hazards  may  be  addressed  through  design,  procedures,  or  training.  Hazards  should 
be  characterized  by  severity  category  and  probability  level  in  accordance  with  MIL-STD-882“. 
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(a)  Severity  Categories.  The  severity  categories  as  defined  in  MIL-STD-882  provide 
a  qualitative  measure  of  the  worst  credible  mishap  resulting  from  personnel  error,  environmental 
condition,  design  inadequacies,  procedural  deficiencies,  or  component  failure  or  malfunction. 
Hazard  categories  are  as  follows: 

1  Category  I.  Catastrophic  hazard  that  could  result  in  death  or  system  loss. 

2  Category  II.  Critical  hazard  that  could  result  in  severe  injury,  severe 
occupational  illness,  or  major  system  damage. 

3  Category  III.  Marginal  hazard  that  could  result  in  minor  injury,  minor 
occupational  illness,  or  minor  system  damage. 

4  Category  IV.  Negligible  hazard  that  could  result  in  less  than  minor  injury, 
occupational  illness,  or  system  damage. 

(b)  Probability  Levels.  The  probability  levels  rate  the  categories  in  terms  of 
probability  for  occurrence  per  unit  of  time,  events,  population,  items,  or  activity.  These  are  as 
follows: 


1  Level  A.  Frequent.  The  hazard  would  be  likely  to  occur  frequently  for  a 
specific  individual  item  or  be  continuously  experienced  by  the  fleet  or  inventory. 

2  Level  B.  Probable.  The  hazard  would  occur  several  times  in  the  life  of  a 
specific  individual  item  or  would  occur  frequently  for  the  fleet  or  inventory. 

3  Level  C.  Occasional.  The  hazard  is  likely  to  occur  some  time  in  the  life  of  a 
specific  individual  item  or  will  occur  several  times  for  the  fleet  or  inventory. 

4  Level  D.  Remote.  Unlikely,  but  possible,  for  the  hazard  to  occur  in  the  life  of 
a  specific  individual  item  or  unlikely,  but  reasonably  expected,  for  the  hazard  to  occur  for  the 
fleet  or  inventory. 

5  Level  E.  Improbable.  So  unlikely  that  it  could  be  assumed  that  the  hazard  may 
not  occur  for  a  specific  individual  item  or  the  hazard  is  unlikely,  but  possible,  to  occur  for  the 
fleet  or  inventory. 

(4)  Assure  that  the  proper  training  for  the  operation  of  the  system  is  provided  to  the 
testers  and  operators.  It  is  imperative  that  the  emergency  shut  down  procedures  are  emphasized 
in  this  training.  An  operator  must  be  well  trained  in  what  to  do  should  a  problem  occur. 

(5)  Upon  receipt  of  the  test  item,  select  a  suitable  offloading  site  that  provides 
positive  controls  to  prevent  injury  or  damage  in  the  event  of  uncommanded  movement. 
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(6)  Wherever  possible,  conduct  non-mobile  tests  where  the  UGV  is  prevented  from 
moving  (i.e.,  elevated  on  jack  stands)  prior  to  conducting  tests  on  course.  Tests  on  actual  courses 
should  not  be  attempted  before  a  reasonable  level  of  confidence  has  been  achieved  that  the  UGV 
will  not  have  uncommanded  movement.  Instrumentation  should  be  used  to  simulate  various 
environments  in  a  static  setting.  An  example  would  be  using  attenuators  to  reduce  RF  signal 
strength  in  order  to  detennine  if  there  is  uncommanded  movement  of  the  UGV  when  receiving  a 
weak  RF  signal. 

(7)  When  detennining  the  safety  characteristics  of  a  tethered  UGV,  conduct  the  test 
in  an  area  where  there  is  a  physical  barrier  (i.e.,  Jersey  walls)  between  the  UGV  operator  and  the 
UGV.  The  physical  barrier  must  be  substantial  enough  to  prevent  the  UGV  from  entering  the 
area  around  the  operator  in  the  event  of  uncommanded  movement.  Once  sufficient  confidence 
has  been  achieved  as  to  the  reliability  of  the  tethered  controller,  the  barriers  may  no  longer  be 
necessary.  The  safety  characteristics  of  the  tethered  controller  must  be  determined  prior  to 
operating  a  tethered  UGV  around  personnel  or  into  and  out  of  shops  and  work  areas. 

(8)  The  UGV  must  be  outfitted  with  an  independent  emergency  shutdown.  This  E- 
stop  device  must  be  separate  from  the  onboard  computers  and  is  provided  as  backup  to  the 
integrated  emergency  shutdown  device.  The  backup  system  must  be  capable  of  performing 
emergency  shutdown  of  the  UGV  on  command  from  an  independent  observer.  This  feature  must 
be  completely  independent  of  the  OCU  and  VCU  and  any  onboard  computers  that  are  part  of  the 
UGV  command  and  control  system.  This  independent  emergency  shutdown  system  should  be 
capable  of  being  operated  by  an  occupant  in  the  command  vehicle,  an  independent  observer  in 
another  vehicle  (i.e.,  chase  vehicle)  or  by  an  observer  in  a  location  away  from  the  command 
vehicle.  In  addition  to  the  emergency  stop,  the  platfonn  brakes  must  be  applied  by  a  failsafe, 
mechanical  device. 

(9)  Medium  and  large  UGVs  should  be  fitted  with  a  strobe  light,  which  indicates  the 
test  item  is  under  remote  control  (at  Aberdeen  Test  Center  (ATC),  a  blue  light  will  be  used;  at 
other  test  centers,  a  standout  color  that  is  not  already  allocated  for  another  use  will  be  chosen). 
This  light  will  activate  whenever  an  operator  logs  into  the  vehicle  or  whenever  the  vehicle  is 
functioning  robotically.  The  UGV  should  also  be  fitted  with  an  audible  alarm  which  activates 
whenever  the  UGV  is  beginning  to  move. 
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4.  TEST  PROCEDURES. 

a.  The  following  table  provides  a  list  of  test  procedures  and  data  required  that  should  be 
considered  when  designing  a  comprehensive  UGV  test. 


Subtest 

Method 

Description 

Characteristics 

Preliminary  Inspection 

TOP~2^2^50? 

Provides  inspection  and 
baseline  operation  prior  to 
initiation  of  testing. 

Ensures  test  item  is  safe  and 
ready  to  initiate  testing. 

Physical  Characteristics 

TOP  1-2-5044 

Determines  dimensions  and 
other  physical 
characteristics  of  the  test. 
Physical  characteristics  data 
are  critical  data  used  in 
mobility  analyses  and 
transportability. 

Weight  Distribution  and 
Ground  Pressure 

TOP  2-2-801s 

ITOP  2-2-80 1  ( l)6 

Determines  weight 
distribution  and  ground 
pressure  measurements. 
Ground  pressure 
measurements  are  critical 
data  used  in  mobility 
analyses,  tire  performance, 
and  transportability. 
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Subtest 

Method 

Description 

Center  of  Gravity 

TOP  2-2-8007 

ITOP  2-2-800(l)8 

Provides  infonnation 
relative  to  roll  stability, 
transportability,  and  input  to 
mobility  model  programs. 

Stowage 

TOP  2-2-802y 

Determines  adequacy  of  on¬ 
board  equipment  stowage 
facilities  in  or  on  vehicles. 

Transportability 

ITOP  l-2-500(l)lu 

TOP  1-2-50011 

Determines  transportability 
characteristics  of  military 
equipment.  Includes 
highway,  marine,  air  (rotary 
and  fixed  wing),  and  rail 
transport  as  well  as  lift  and 
tie-down  provisions. 

Rail  Impact 

TOP  1-2-501 12 

Determines  structural 
integrity  of  the  test  item  as 
well  as  the  adequacy  of  the 
tie-down  system  and  tie¬ 
down  procedures. 

Final  Inspection 

TOP  2-2-505 

Provides  inspection  and 
baseline  operation 
following  completion  of 
testing 

Performance 

Acceleration/Max  Speed 

TOP  2-2-6021J 

ITOP  2-2-602(l)14 

Determines  vehicle 
performance  and  safety 
characteristics  while 
accelerating.  Determines 
vehicle  maximum  safe 
speed  capability. 

Braking 

TOP  2-2-608 15 

ITOP  2-2-627(l)16 

Determines  vehicle 
performance  and  safety 
characteristics  while 
braking. 
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Subtest 

Method 

Description 

Grades  and  Slopes 

TOP  2-2-6 101' 

ITOP  2-2-610(l)18 

Determines  vehicle 
performance  and  safety 
characteristics  while 
operating  on  longitudinal 
and  lateral  slopes. 

Steering  and  Handling 

ITOP  2-2-609(1  )iy 

TOP  2-2-60920 

Determines  performance 
and  safety  characteristics  of 
vehicle  steering  systems. 

Standard  Obstacles 

TOP  2-2-61 l21 

ITOP  2-2-611(1)" 

Determines  vehicle 
performance  and  safety 
characteristics  while 
operating  on  standard 
obstacles  to  include  gaps, 
walls,  v-ditch,  aircraft 
loading  ramps,  and  frame 
twisting. 

Fording 

TOP  2-2-6 1223 

ITOP  2-2-6 12(1)24 

Determines  vehicle 
performance  and  safety 
characteristics  while 
fording.  Includes  shallow, 
deep,  and  submerged 
fording. 

LOS/NLOS 

TOP  2-2-54325 

Determines  operating  and 
safety  characteristics  of 
tele-operated  and  remotely 
operated  unmanned  ground 
systems  while  operating  at 
their  maximum  telemetric 
ranges. 

Soft  Soil  Mobility 

TOP  2-2-6 1926 

ITOP  2-2-6 1 9(1)27 

Determines  vehicle 
performance  and  safety 
characteristics  while 
operating  in  soft  soils. 
Includes  mud,  sand,  snow, 
swamps,  wet  clay,  and  rice 
paddies. 

Winch  and  Tow 

Performance 

TOP  2-2-7 1228 

Determines  performance 
and  safety  characteristics  of 
automotive  winches. 
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Subtest 

Method 

Description 

Drawbar  Pull 

TOP  2-2-604-9 

ITOP  2-2-604(l)30 

Determines  vehicle  power 
available  for  acceleration, 
towing,  or  hill  climbing. 

Full-Load  Cooling 

TOP  2-2-60731 

ITOP  2-2-60732 

Determines  cooling 
characteristics  of  engine, 
power  train,  and  auxiliary 
components  of  vehicles 
when  subjected  to  full-  and 
part-throttle  operations, 
repeated  steering 
maneuvers,  and  exposure  to 
extreme  environments. 

Software  Performance 

ITOP  1-1-05633 

Used  to  evaluate  a  system’s 
software  functional 
capabilities.  It  does  not 
specifically  address  other 
software-related  issues, 
such  as  safety  or  security. 

The  method  for  undertaking 
the  software  performance 
assessment  discussed  in  this 
document  addresses 
software  T&E  as  an  integral 
element  of  system  T&E  and 
is  targeted  at  the  system 
performance  level.  Key 
elements  of  this  approach 
include  the  allocation  of 
system  requirements  to 
software,  assessment  of 
software  performance,  and 
assessment  of  the  impact  of 
software  on  overall  system 
performance. 
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Subtest 

Method 

Description 

Autonomous  Navigation 

TOP  2-2-544  (Draft) 

Used  to  evaluate  the  safety 
and  perfonnance  of  UGVs 
equipped  with  Autonomous 
Navigation  and  Obstacle 
Avoidance  subsystems. 

This  procedure  includes 
methods  to  evaluate  way- 
point  navigation,  obstacle 
detection  and  avoidance, 
and  human  detection  and 
avoidance.  This  TOP  is  not 
yet  developed. 

Electric  System 

Performance 

TOP  2-2-60  F*4 

Provides  procedures  for 
evaluation  vehicle  electrical 
system  perfonnance 
including  power  supply  for 
weapons  and  other 
subsystems. 

Position  Locations  and 
Navigation  System 

TOP  6-2-598  ^ 

Used  to  detennine  the 
performance  and  accuracy 
of  integrated  position 
location  and  navigation 
systems. 

C4ISR 

TBD 

Determines  the  performance 
and  safety  characteristics  of 
embedded  C4ISR 
subsystems. 

Intelligent  Controllers 

TBD 

Verifies  safety  and 
performance  of  UGV 
control  units.  This  TOP  is 
not  yet  developed. 

Autonomous  Obstacle 
Detection  and  Avoidance 

TBD 

Determines  safety  and 
performance  characteristics 
of  a  UGV’s  obstacle 
detection  and  avoidance 
system.  This  TOP  is  not  yet 
developed. 
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Subtest 

Method 

Description 

UGV  Sensors 

TBD 

Validates  the  adequacy  and 
accuracy  of  UGV  sensors  as 
part  of  the  UGV  system. 

This  TOP  is  not  yet 
developed. 

CTIS  Perfonnance 

TBD 

Logistics 

Maintainability 

TOP  2-2-50336 

ITOP  2-2-509(l)37 

Determines  the 
maintainability 
characteristics  of  vehicles. 

Logistics  Supportability 

TOP  1-1  -030J8 

Determines  the  logistic 
supportability  of  the  test 
item  through  quantitative 
and  qualitative  analysis  of 
the  test  item. 

Reliability,  Availability, 
Maintainability 

ITOP  2-2-506" 

ITOP  2-2-509 

TOP  2-2-50640 

Quantitative  analysis  of 
data  collected  during 
endurance  testing  in  order 
to  determine  the  overall 
ability  of  the  system  to 
complete  tasks. 

Technical  Manuals 

TBD 

Determines  adequacy  and 
accuracy  of  provided 
system  technical  manuals. 

Fuel  Consumption 

TOP  2-2-60341 

ITOP  2-2-60342 

Determines  vehicle  fuel 
consumption  during  both 
controlled  and  typical 
service  operating 
environments 

New  Equipment  Training 

Determines  adequacy  and 
accuracy  of  provided 
system  training. 
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Subtest 

Method 

Description 

BIT/BITE  Embedded 
Diagnostics 

Used  to  evaluate  system 
particular  test, 
measurement,  and 
diagnostic  equipment.  This 
test  also  takes  into 
consideration  not  only  the 
interface  between  the  test 
equipment  and  the  system, 
but  also  the  interface 
between  the  test  equipment 
and  other  elements  of  the 
planned  maintenance 
support  such  as  manuals, 
repair  parts,  common  test 
equipment  and  tools,  and 
calibration  facilities,  etc. 

Training  Devices 

TBD 

Verifies  the  safe  integration 
of  training  devices  to 

UGV’s. 

Safety/Software 

System  Safety 

TOP  1-1-06043 

TOP  2-2-50844 

Used  to  identify  and 
evaluate  hazards  associated 
with  test  items.  Testing  will 
provide  determination  or 
assessment  of  personnel  and 
equipment  hazards  in  the 
system  and  associated 
operation  and  maintenance 
hazards. 
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Subtest 

Method 

Description 

Critical  Software  Analysis 
and  Testing 

ITOP  1-1-0574S 

Describes  the  activities 
necessary  to  ensure  that 
safety  is  designed  into 
software  that  is  acquired  or 
developed  and  that  safety  is 
maintained  throughout  the 
software  life  cycle.  It 
provides  uniform 
procedures  for  developing 
and  implementing  a  safety- 
critical  software  test 
methodology  of  sufficient 
comprehensiveness  to 
identify  the  software  caused 
hazards  of  a  system  and  to 
impose  design  requirements 
and  management  controls  to 
prevent  mishaps.  The 
objective  is  to  ensure  that 
the  software  design  takes 
positive  measures  to 
enhance  system  safety,  and 
that  software  errors  which 
could  reduce  system  safety 
have  been  eliminated  or 
controlled  to  an  acceptable 
level  of  risk. 

Tele-operation 

TBD 

Anti-Tamper  Performance 

TBD 

Used  to  verify  security  and 
information  assurance 
characteristics  of  UGV’s. 

This  TOP  is  not  yet 
developed. 
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Subtest 

Method 

Description 

Modeling  and  Simulation 

ITOP  1-1-001 46 

ITOP  1-1-00247 

Used  to  verify  accuracy  and 
adequacy  of  system  models 
and  provides  guidelines  to 
ensure  consistent 
documentation  of  the  use  of 
modeling  and  simulation 
technology  in  support  of 
test  and  evaluation. 

Fire  Extinguisher  System 

TBD 

Detennines  performance 
characteristics  of  vehicle 
on-board  fire  extinguisher 
system. 

Human  Machine  Interface 

Human  Factors 

TOP  1-2-61048 

Used  to  provide  human 
factors  engineering 
assessment  of  equipment. 

Noise  Levels 

TBD 

Used  to  determine  operating 
noise  levels. 

NBC  Performance 

TBD 

Toxic  Fumes 

TOP  2-2-6 1449 

Displays  and  Controls 

TBD 

Used  to  evaluate  human 
machine  interface  between 
the  operator  and  the  UGV 
control  unit. 

Environmental 

Environmental  Perfonnance 

-  High  Temperature 

-  Low  Temperature 

-  Temperature  Shock 

-  Solar  Radiation 

-  Rain 

-  Humidity 

-  Fungus 

-  Salt  Fog 

-  Sand  and  Dust 

-  Icing/Freezing  Rain 

-  Shock 

-  Vibration 

TOP  2-4-001 50 

TOP  2-4-00251 
MIL-STD-81052 

Determines  the  operating, 
maintenance,  and  durability 
characteristics  of  unmanned 
ground  vehicles  when 
operating  in  extreme 
environments. 
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Subtest 

Method 

Description 

EMI/EMC 

-  Radiated  Emissions 

-  Radiated  Susceptibility 

-  HERO 
-HERF 

-HERP 

-  HESD 

-  PESD 
-HEMP 

-  Near  Strike  Lightning 

-  Bonds  and  Grounds 

-  Conducted  Susceptibility 

-  Conducted  Emissions 

-  Intra-system  EMC 

TOP  1  -2-5  1 2^ 

TOP  1-2-5 11 54 

TOP  2-2-61355 

Determines  whether  the 
item  tested  meets  the 
electromagnetic  radiation 
effects,  static  electricity, 
and  lightning  criteria  and 
the  maximum 
electromagnetic  radiation 
environment  to  which  the 
test  item  may  be  exposed 
without  adverse  effects. 
Ensures  that  the  equipment 
under  test  is  able  to  operate 
in  its  intended 
electromagnetic 
environment  without  its 
performance  being 
degraded  and  without 
degrading  the  performance 
of  other  system(s)  in  close 
proximity 

Survivability 

Nuclear  Survivability 

TOP  1-2-6 1256 

Determines  the  effects  of  a 
specified  nuclear 
environment  on  an 
unmanned  ground  vehicle. 

Armor/Survivability 

ITOP  2-2-6 17y/ 

ITOP  4-2-50858 

Determines  the 
vulnerability  of  unmanned 
ground  vehicles  and  their 
components  and  subsystems 
to  various  levels  of  threats 
including,  but  not  limited  to 
IEDs,  mines,  etc. 

Signature  Measurements 

TBD 

Chemical  Survivability 

TBD 

Weapons 

Autoloader  Ammunition 
Compatibility 

TBD 

Azimuth  and  Elevation 
Control  Systems 

TBD 

Autoloader  Performance 

TBD 
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Subtest 

Method 

Description 

Boresighting 

ITOP  3-2-836(2. l.l)iy 

Detects  angular  changes 
between  gun  and  sighting 
systems,  with  or  without  the 
aid  of  an  MRS,  after  vehicle 
operations  over  cross¬ 
country  courses  and 
primary  and  secondary 
roads,  after  firing,  and  after 
a  period  of  temperature 
changes. 

Computer  Solutions 

ITOP  3-2-836(2.4. 1)6U 

Non-firing  tests  that 
determine  the  differential 
angle  between  the  main 
weapon  and  sight  line 
(ballistic  solution) 
generated  by  a 
computerized  fire  control 
system  in  response  to  given 
inputs. 

Fields  of  Fire 

TOP  3-2-8 1361 

Determining  the  given  area 
which  a  weapon  or  group  of 
weapons  can  cover 
effectively  with  fire  from  a 
given  position  for  vehicle- 
mounted  primary  and 
secondary  armament.  This 
includes  maximum 
elevation  and  depression 
angles  at  all  traverse 
positions;  maximum 
traverse  angles  or 
provisions  for  continuous 
traverse;  and  minimum 
range  of  anti-personnel  fire 
at  all  positions  of  traverse. 

Frequency  Response 

ITOP  3-2-836(1. 3.2.3)62 

Determines  the  frequency 
response  characteristics  of 
UGV  gun/turret  drive 
systems  in  the  turret 
whether  they  are  installed 
on  UGVs  or  on  test  stands. 
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Subtest 

Method 

Description 

Rangefinder 

ITOP  5-2-618“ 

Evaluates  the  performance 
and  safety  characteristics  of 
laser  rangefinders  under  a 
variety  of  expected 
operating  conditions. 

Weapon  Firing/Accuracy 

ITOP  3-2-836(2.2. 1)64 

Determines  the  unintended 
deviation  of  the  LOS  of  a 
stabilized  gun/turret  and  a 
stabilized  sighting  system. 

Target  Acquisition  and 
Tracking 

ITOP  3-2-836(2.3.5)“ 

Used  to  measure  the  target 
tracking  capability  of  a 

UGV  mounted  optical  or 
electro-optical  sighting 
system  operated  by  an 
automatic  system,  under 
specified  conditions  in  the 
laboratory  and  in  the  field. 

Sight  Plumb  &  Synch 

ITOP  3-2-836(2. 1.2)66 

Evaluates  the  capability  of 
vehicle-mounted  main-gun 
sighting  systems. 

Stabilization 

ITOP  3-2-836(1. 3.2. 2)67 

Determines  the  stabilization 
performance  of  the  UGV 
gun/turret  drive  systems  in 
the  turret  whether  they  are 
installed  on  the  UGVs  or  on 
the  test  simulators. 

Time-of-fire,  Rate-of-fire 

ITOP  3-2-836(2.3. 4)ax 

Used  to  detennine  times 
necessary  to  complete 
various  aspects  of  the  target 
engagement  sequence. 

Autonomous  Target 
Acquisition 

TBD 

Used  to  evaluate  the  safety 
and  perfonnance  of 
automatic  and  un¬ 
commanded  target 
acquisition  systems. 

Includes  procedures  to 
evaluate  a  system’s  ability 
to  acquire,  classify,  identify 
and  track  various  targets. 

This  TOP  is  not  yet 
developed. 
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Subtest 

Method 

Description 

Electromagnetic 

Interference 

Interference 

MIL-STD-46 1 E69 

Provides  verification 
requirements  for  the  control 
of  the  electromagnetic 
interference  (emission  and 
susceptibility) 
characteristics  of  electronic, 
electrical,  and 
electromechanical 
equipment  and  subsystems. 

Interface  requirements 

MIL-STD-464A™ 

Establishes  electromagnetic 
environment  effects 
interface  requirements  and 
verification  criteria  for 

UGVs. 

E3  Control 

MARINE  CORPS  ORDER 
2410.2B,  E3  CONTROL71 

5.  DATA  REQUIRED. 

The  content  explaining  the  data  to  be  acquired  for  the  testing  of  UGVs  is  outlined  in  Section  5  of 
TOP  2-2-541 72  and  TOP  2-2-54273.  Section  5  of  TOP  2-2-541  addresses  the  data  required  for 
safe  mobility  testing  of  UGVs,  while  Section  5  of  TOP  2-2-542  addresses  the  data  required  for 
the  testing  of  Weaponized  UGVs. 

6.  PRESENTATION  OF  DATA 


a.  Describe  the  inspection,  specific  test  procedures,  and  results  for  each  item  using 
narration,  tables,  photographs,  x-rays,  charts,  and  graphs  as  appropriate  or  as  outlined  in  the 
procedures  specific  methodology. 

b.  Reduce,  summarize,  and  analyze  data  from  each  subtest  appropriate  to  the  subtest  data 
topic  and  failure  definitions  derived  specifically  for  the  item  and  the  subtest  category.  When 
unique  analytical  tools  (i.e.,  models,  simulations,  statistical  techniques)  are  used,  these  should  be 
described  in  sufficient  detail  to  enable  the  reader  to  understand  the  basis  for  the  analysis. 
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APPENDIX  A.  FREQUENCY  ALLOCATION  FORM 


( 1 )  Name  of  Program 

(2)  Purpose  of  Program 

(3)  Security  Classification 

(4)  Frequency 

(5)  Transmitter  Power  (Watts) 

(6)  Time  of  Usage 

(7)  Required  Start  and  End  Dates 

(8)  Transmitter  Nomenclature 

(9)  Transmitter  Location 

(10)  Transmitter  Antenna  Data 

(a)  Type/Name 

(b)  Gain 

(c)  Site  Elevation 

(d)  Antenna  Feedpoint  Height 

(e)  Orientation 

(f)  Polarization 

(11)  Receiver  Nomenclature 

(12)  Receiver  Location 

(13)  Receiver  Antenna  Data 

(a)  Type/Name 

(b)  Gain 

(c)  Site  Elevation 

(d)  Antenna  Feedpoint  Height 

(e)  Orientation 

(f)  Polarization 

(14)  J/F-12  Number  (if  assigned) 
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APPENDIX  B.  DOCUMENT  REVIEW  CHECKLIST 
DTC  Test  Checklist  (Reference  DA  PAM  73-1) 

In  order  to  properly  assess  the  safety,  perfonnance,  and  reliability  of  a  UGV,  a  detailed 
documentation  review  must  be  conducted.  This  documentation  review  provides  a  more  thorough 
understanding  of  UGV  characteristics  and  in  some  instances  can  reduce  the  amount  of  physical 
testing  required  and  can  assist  in  reducing  the  assigned  risk  assessment  code  reported  in  safety 
releases.  The  documentation  review  is  required  in  order  to  ensure  that  proper  safety  protocols 
are  emplaced  prior  to  initiation  of  testing.  The  following  documents  should  be  included  in  the 
test  item  data  package;  it  is  preferable  that  these  documents  be  provided  as  early  as  possible  prior 
to  the  start  of  testing. 

1 .  Safety  Assessment  Report. 

2.  Health  Hazard  Assessment  Report. 

3.  All  test  data  available  regarding  the  item  requiring  the  Safety  Release.  If  no  current 
test  data  are  available,  any  other  information  that  can  be  used  (for  example,  prior 
Government  test  data,  contractor  test  data),  with  the  emphasis  on  safety  data. 

4.  Environmental  documentation. 

5.  Training  plans. 

6.  Equipment  publications. 

7.  Mission  scenario/mission  profile. 

8.  Test  Plan. 

9.  Test  and  Evaluation  Master  Plan. 

10.  Frequency  Allocation  Documentation. 

1 1 .  Software  Requirements  Specification. 

12.  CHPPM  Certifications  (Laser  and  High  Power  RF). 

13.  System  Requirements  Document. 

14.  Security  Classification  Guide. 

15.  Source  of  troops  involved  in  operational  testing. 

16.  Test  Readiness  Review 
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When  sufficient  data  are  not  available  on  which  to  base  a  Safety  Release,  additional  testing  may 
be  necessary.  In  such  cases,  required  testing  will  be  perfonned  by  DTC,  and  test  costs  will  be 
paid  by  the  materiel  developer;  the  time  required  for  issuing  a  Safety  Release  would  increase 
accordingly.  DTC  will  issue  the  Safety  Release  to  the  operational  test  activity  with  a  copy 
furnished  to  the  U.S.  Army  Training  and  Doctrine  Command  (TRADOC). 
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May  1987. 

15.  TOP  2-2-608,  Braking,  Wheeled  Vehicles,  20  May  2008. 

16.  ITOP  2-2-627(1),  Tracked  Vehicle  -  Breaking,  21  May  1987. 

17.  TOP  2-2-610,  Gradeability  and  Side  -  Slope  Performance,  18  July  1980. 

18.  ITOP  2-2-610(1),  Tracked  Vehicle  -  Gradeability  &  Side-Slope  Performance,  21  May 
1987. 

19.  ITOP  2-2-609(1),  Tracked  Vehicle  -  Steering,  18  May  1987 

20.  TOP  2-2-609,  Steering,  18  July  1980. 
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21.  TOP  2-2-611,  Standard  Obstacles,  25  June  1980. 

22.  ITOP  2-2-611(1),  Standard  Obstacles,  21  May  1987. 

23.  TOP  2-2-612,  Fording,  21  November  2007. 

24.  ITOP  2-2-612(1),  Tracked  Vehicle  -  Fording,  18  May  1987 

25.  TOP  2-2-543,  Line-Of-Sight/Non-Line-Of-Sight  Testing  of  Unmanned  Ground  Vehicle 
(UGV)  Systems,  24  November  2008 

26.  TOP  2-2-619,  Soft-Soil  Vehicle  Mobility,  21  May  1970. 

27.  ITOP  2-2-619(1),  Tracked  Vehicle  -  Soft  Soil  Mobility,  01  June  1987. 

28.  TOP  2-2-712,  Automotive  Winches,  20  January  1987. 

29.  TOP  2-2-604,  Drawbar  Pull,  26  September  2007. 

30.  ITOP  2-2-604(1),  Tracked  Vehicle  -  Drawbar  Pull  on  Soft  Soil,  20  May  1987,  w/chl  1 1 
August  1987. 

31.  TOP  2-2-607,  Cooling  Systems  (Automotive),  27  September  2006. 

32.  ITOP  2-2-607(1),  Tracked  Vehicle  -  Full  Load  Cooling,  21  May  1987. 

33.  ITOP  1-1-056,  Software  Performance  Testing  and  Analysis,  22  March  2002. 

34.  TOP  2-2-601,  Electrical  Systems  (Vehicles  and  Weapon  Subsystems),  20  June  1977. 

35.  TOP  6-2-598,  Position  Location  and  Navigation  Systems  (Plans),  31  July  1989. 

36.  TOP  2-2-503,  Maintenance  (Vehicle),  5  June  1966. 

37.  ITOP  2-2-509(1),  Tracked  Vehicle  Reliability,  Availability  and  Maintainability,  28  May 
1987,  w/chl  11  August  1987. 

38.  TOP  1-1-030,  RAM-D  and  ILS  Analysis,  8  September  2008. 

39.  ITOP  2-2-506(1),  Tracked  Vehicle  Endurance  Testing,  15  May  1987. 

40.  TOP  2-2-506,  Endurance  Testing  of  Tracked  and  Wheeled  Vehicles,  26  June  1981. 

41.  TOP  2-2-603,  Vehicle  Fuel  Consumption,  4  February  1986. 

42.  ITOP  2-2-603(1),  Tracked  Vehicle  Fuel  Consumption,  18  May  1987. 

43.  TOP  1-1-060,  System  Safety  Engineering,  12  September  1986. 
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44.  TOP  2-2-508,  Automotive  Safety  and  Health  Hazard  Evaluation,  24  November  1982. 

45.  ITOP  1-1-057,  Safety  Critical  Software  Analysis  and  Testing,  4  June  1999. 

46.  ITOP  1-1-001,  General  Guidance  for  Incorporating  Modeling  and  Simulation  in  Test 
Operations  Procedures,  6  September  2004. 

47.  ITOP  1-1-002,  General  Procedure  for  Modeling  and  Simulation  Verification  and 
Validation  information  Exchange,  13  May  2004. 

48.  TOP  1-2-610,  Human  Factors  Engineering  (Test  Procedure),  15  May  1990 

49.  TOP  2-2-614,  Toxic  Hazards  Test  for  Vehicles  and  other  Equipment,  31  October  2003. 

50.  TOP  2-4-001,  Desert  Environmental  Testing  of  Wheeled  and  Tracked  Vehicles,  12  May 
1969. 

51.  TOP  2-4-002,  Arctic  Environmental  Test  of  Tracked  and  Wheeled  Vehicles,  10  July 
1969. 

52.  MIL-STD-810,  Environmental  Engineering  Considerations  and  Laboratory  Tests,  1 
January  2000. 

53.  TOP  1-2-512,  Electromagnetic  Compatibility  Tests,  15  May  1995. 

54.  TOP  1-2-511,  Electromagnetic  Compatibility  Requirements,  Systems  Testing,  29 
December  1989. 

55.  TOP  2-2-613,  Electromagnetic  Interference  Testing  for  Vehicles  and  Electrical 
Subsystems  -  Non-Communications,  16  December  1994. 

56.  TOP  1-2-612,  Nuclear  Environment  Survivability,  24  October  2008. 

57.  ITOP  2-2-617,  Vulnerability  Testing  of  Combat  Vehicles  and  Their 
Components/Subsystems  (Utilizing  Conventional  Weapons),  21  October  2003 

58.  ITOP  4-2-508,  Vehicle  Vulnerability  Tests  Using  Mines,  14  April  2005. 

59.  ITOP  3-2-836(2.1.1),  Main  Battle  Tank  Fire  Control  Systems  -  Boresight  &  Muzzle- 
Reference  -  System  Alignment/Retention,  31  March  1987. 

60.  ITOP  3-2-836(2.4.1),  Main  Battle  Tank  Fire  Control  Systems  -  Computerized 
Corrections,  29  June  1995. 

61.  TOP  3-2-813,  Field  of  Firing,  22  March  1985. 

62.  ITOP  3-2-836(1.3.2.3),  Combat  Vehicle  Fire  Control  System  -  Gun/Turret  Drive 
Systems  -  Frequency  Response,  8  April  2002. 
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63.  ITOP  5-2-618,  Laser  Weapon  Danger  Areas,  10  June  2005. 

64.  ITOP  3-2-836(2.2.1),  Main  Battle  Tank  Fire  Control  Systems  -  Stabilization  Accuracy. 
29  June  1995. 

65.  ITOP  3-2-836(2.3.5),  Combat  Vehicle  Fire  Control  System  -  Target  Tracking,  10  April 
2000. 

66.  ITOP  3-2-836(2.1.2),  Main  Battle  Tank  Fire  Control  Systems  -  Gun/Sight 
Synchronization,  31  March  1987. 

67.  ITOP  3-2-836(1.3.2.2),  Combat  Vehicle  Fire  Control  System  -  Gun/Turret  Drive 
Systems  -  Stabilization,  16  October  2000. 

68.  ITOP  3-2-836(2.3.4),  Combat  Vehicle  Fire  Control  System  -  Target  Engagement  Times, 
26  October  1999. 

69.  MIL-STD-461E,  Requirements  for  the  Control  of  Electromagnetic  Interference 
Characteristics  of  Subsystems  and  Equipment,  20  August  1999 

70.  MIL-STD-464A,  Electromagnetic  Environmental  Effects  Requirements  for  Systems,  19 
December  2002 

71.  Marine  Corps  Order  2410.2B,  Electromagnetic  Environmental  Effects  (E3)  Control 
Program,  12  March  1997 

72.  TOP  2-2-541,  Safe  Operation  of  Mobile  Unmanned  Ground  Vehicle  (UGV)  Systems, 

08  July  2008 

73.  TOP  2-2-542,  Safe  Operation  of  Weaponized  Unmanned  Ground  Vehicle  (UGV) 
Systems,  08  July  2008 
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Forward  comments,  recommended  changes,  or  any  pertinent  data  which  may  be  of  use  in 
improving  this  publication  to  the  following  address:  Test  Business  Management  Division 
(TEDT-TMB),  US  Army  Developmental  Test  Command,  314  Longs  Corner  Road  Aberdeen 
Proving  Ground,  MD  21005-5055.  Technical  information  may  be  obtained  from  the  preparing 
activity:  TEDT-AT-AD-F,  U.S.  Army  Aberdeen  Test  Center,  400  Colleran  Rd.,  APG,  MD 
21005-5055.  Additional  copies  can  be  requested  through  the  following  website: 
http  ://itops  .dtc .  army.mil/RequestF orDocuments  .aspx,  or  through  the  Defense  Technical 
Information  Center,  8725  John  J.  Kingman  Rd.,  STE  0944,  Fort  Belvoir,  VA  22060-6218.  This 
document  is  identified  by  the  accession  number  (AD  No.)  printed  on  the  first  page. 


